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When Lundbeck processes personal data collected through other channels than via Lundbeck.com, H. Lundbeck A/S will specifically inform you how your personal data is 
processed. However, for certain specific processing activities where personal data is collected or obtained via other channels/devices/third parties than Lundbeck.com, you can 


read more below. 




















video is the camera capturing your 
whereabouts and actions on 





Lumsås. 





6(1)(f) of the GDPR. 





the Danish Data Protection 





Type of Categories of personal data and Purpose of Legal basis Disclosure of personal Retention 
processing source if relevant processing data, if relevant and legal 
and basis for the disclosure 
categories of 
individuals 
Employee e Name and contact information e Being able to contact | The legal basis is Personal data related to 
emergency an employee’s next Lundbeck’s legitimate next of kin will be deleted 
contact - Next The source of data regarding you as of kin in case of an interest in being able once the relevant Lundbeck 
of kin to next of kin to a Lundbeck employee is emergency. to contact the next of employee no longer works 
employees at the employee. kin in case of an at Lundbeck. 
H. Lundbeck emergency, cf. Article 
A/S 6(1)(f) of the GDPR. 
Scientific e Health information e Asapharmaceutical | The legal basis is The data may be Personal data related to 
research data e Biological material / human samples company, Lundbeck | Article 6 (1) (f) 9 (2)(j) | transferred, including to scientific research will be 
/ ‘future e Other related data, e.g. demographic processes personal of the GDPR cf. the universities, partners or deleted according to 
research’ on data, age, sex. data for scientific Danish Act on authorities, subject to the Lundbeck internal retention 
clinical trial research purposes Processing of provisions set out in Section | periods. 
data . aE within a range of Personal Data 10 of the the Danish Act on 
Hee S ee a aln aa areas. Read more Section 10 or specific | Processing of Personal 
b i ‘ about Lundbeck’s consent cf. Article 9 Data or based on a consent 
ases, including public databases and ae oats i 
biobanks, or data from Lundbeck’s own activities within (2) (a). (Article 9 (2) (a). 
clinical trial activity. Sedan es 
development here. As regards Article 6 In specific cases, other 
; ; (1) (f), being a appropriate legal basis may 
The personal data is pseudonymised pharma company be relied upon. 
ats will not be directly Lundbeck has-a 
i legitimate interest in 
conducting scientific 
research. 
Video e Personal data recorded by thermal e Improving the safety | The legal basis is The data obtained via video | Recordings will be deleted 
surveillance — camera on Lundbeck’s property and thereby Lundbeck’s legitimate | surveillance may be shared | after 30 days unless storage 
visitors at the increasing the level interest in trying to with the police in case of for a longer period is 
Lundbeck of security on the prevent, detect and suspicion of an illegal act. required under the Danish 
property in A a one once eu site in Valby and/or solve crime, cf. Article | The legal basis is § 8(4) of TV Monitoring Act. 








Lundbech 





Valby and/or 
Lumsås 


Lundbeck’s property in Valby and/or 
Lumsås. 


If criminal data is 
processed the legal 
basis is § 8 of the 
Danish Data 
Protection Act, cf. 
Article 10 of the 
GDPR. 


Act, cf. Article 10 of the 
GDPR. 





Site access / 
Guest 
registration — 
Externals 
visiting 
Lundbeck’s 
premises in 
Valby and/or 
Lumsas 


e Name, telephone number, email 


address 


e Photo (if applicable) 


The source of data in relation to site 
access/guest registration (when not 
collected directly from you) is either a 
Lundbeck employee or your employer. 


e Being able to 
provide access to 
you as a visitor or an 
external working at 
the site for a limited 
period of time. 


The legal basis is 
Lundbeck’s legitimate 
interest in knowing 
who is always present 
on the site, cf. Article 
6(1)(f) of the GDPR. 


Personal data are stored for 
as long as necessary to fulfil 
the purpose described 
above, however, for site 
access data no longer than 
36 months, and for guest 
registration data no more 
than 12 months. 





Work related 


e Personal data that are a part of the 


e To increase safety 


The legal basis is 


We store your personal data 








accidents — information we collect on how the and to be able to Lundbeck’s legitimate for as long as necessary to 
Externals accident happened. implement corrective | interests in improving fulfil the purposes described 
working at the and preventive site security and above, however for no 
ck The source of data in relation to work actions. eel te longer than 12 months 
related accidents may also be (when fee 
ie ea not collected directly from you) a 6(1)(f) of the GDPR. 
umsas Lundbeck employee or another witness. 
Investors — e Name, e Keeping a register of | The legal basis is Personal data are disclosed | We store your personal data 
Investors’ e Address, Lundbeck’s investors | Lundbeck’s legal to the VP SECURITIES A/S_ | for as long as necessary to 
acquisition of e Number of shares, e Inviting to general obligation the Danish | for the purpose of investor fulfil the purposes described 
shares in H. e Number of votes assembly Companies Act, cf. administration. The legal above, however for no 
Lundbeck A/S e Investor type e Analysing article 6(1)(c) of the basis is section 61 of the longer than 18 months. 
composition of GDPR, and Danish Companies Act, cf. 
investors Lundbeck’s legitimate | article 6(1)(c). 





The source of data in relation to 
investors (when not collected directly 
from you) is VP Securities A/S. 





e Being able to 
communicate with 
investors 





interests in (i) 
analysing the 
composition of 
Lundbeck’s 
shareholders, (ii) 
being able to 
communicate with 
shareholders (e.g. in 
relation to sending out 
invitation for general 














Lundbech 





assembly) and (iii) 
paying dividends to 
shareholders, cf. 
article 6(1)(f) of the 
GDPR. 





Meeting 
participants — 
recording of 


Lundbeck may (audio/video) record 
meeting/presentations/webinars 
(“Meetings”) if is assessed that there 


e Relevant business 
purposes such as for 
example; to ensure 


The legal basis for 
recording is 
Lundbeck’s legitimate 


If deemed necessary, the 
recording may be shared 
with meeting participants or 


We store your personal data 
for a maximum of 30 days, 
unless you have been 








meetings is a specific need and relevant that the meeting can | interests in pursuing a | invited participants that informed otherwise. 
business purpose for this. The be translated in case | relevant business were absent at the meeting. 
Lundbeck meeting host will always of non-English purpose (as The legal basis is 
specifically inform you if video speaking Lundbeck described to the left), Lundbeck’s legitimate 
recording takes place at the Meeting employees or to cf. Article 6(1)(f) of interests in pursuing a 
you will attend. ensure that the video | the GDPR. In light of relevant business purpose 
will be made the business purpose | (as described to the left), cf. 
In case the Meeting you participate available to invited of the meetings, the Article 6(1)(f) of the GDPR. 
in is recorded, we will process participants if they interests of the 
are absent at the participants are Other types of transfer or 
e your digital image (if you have meeting. generally assessed uses (e.g. for larger 
your video camera turned on), not to override meetings; upload to the 
e audio recordings of your Lundbeck's interests. | Lundbeck intranet) will be 
input/question at the meeting assessed on a case by case 
(if you speak), and basis. 
e written input/questions you 
provide via the chat-functions 
(e.g. for webinars or similar). 
Market Lundbeck performs various market e Preforming market The legal basis is We may disclose the market | If the market research study 
Research — research activities. research Lundbeck’s legitimate | research reports or is product related, we keep 
health care interest in during articles/other publicly and use the market 


professionals 
participating in 
questionnaires 
from third party 
Market 
Research 
Partners 





This research may collect the following 
on health care professionals or others: 


- Contact details and 

- Answers to market research 
questions 

- Various professional 
information included e.g. in 








market research in 
order to ensure the 
business of Lundbeck 
confirms with the 
market demand, cf. 
Article 6(1)(f) of the 
GDPR. 





available materials with our 
affiliates and medicinal 
partnerships. 


The legal basis is 
Lundbeck’s legitimate 
interests in pursuing a 
relevant business purpose 
(as described to the left), cf. 
Article 6(1)(f) of the GDPR. 





research reports for a 
period corresponding with 
the patent protection on the 
product + and additional 5 
years. If the market 
research study is not 
product related, both more 
general within a disease 
area or a specified market, 
we keep and use the market 
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articles or other publicly research reports for no 
available materials. longer than 10 years after 
the completion of the 
Often, the answers are collected from a market research study. 


third-party market research partner, and 
compiled into a syndicated data file, 
where the personal details of the 
individuals are not included. 


However, if the relevant market 
research partner holds the key to the 
anonymized data files the data 
contained in the files are still regarded 
as personal data under the GDPR. 
Lundbeck will never get access to the 
key and will therefore never be able to 
link the answers listed in the data files 
to specific persons. 


























Last updated: 16 February 2021 


